Stolen GitHub access exposes code pipelines and cloud secrets

Daily Cyber News: Stolen GitHub access exposes code pipelines and cloud secrets Development pipelines and cloud environments were put at risk after an attacker used stolen GitHub access to probe more than sixty thousand repositories. Roughly four thousand eight hundred compromised accounts submitted pull requests to test whether they could make changes. Researchers confirmed that secrets were stolen from at least one thousand eight hundred thirty five targets. Key context: This wasn’t an exploit against GitHub Actions. Additional detail: The malware searched for repository secrets, cloud credentials, GitHub tokens and AI service keys. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, malware, Stolen GitHub, Stolen, GitHub, access, exposes, code.

Daily Cyber News: Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors A likely small team used an autonomous AI framework to run 25 operations against at least 19 organizations. Unauthorized access or data retrieval was confirmed at 10 targets, including organizations in the semiconductor, defense-policy and civil-society sectors. The framework used open-source tooling and commercial AI models to plan and execute tasks. Key context: The important change is scale. Additional detail: For leaders, this means exposed services and weak identities are likely to be tested more persistently and across more targets. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Attackers Use Autonomous AI, Target Semiconductor, Civil Society Sectors, Attackers, Autonomous, Target, Semiconductor.

Daily Cyber News: N-central servers breached hours after public exploit release N-central servers were compromised within hours of public exploit code appearing. That exposed a trusted management layer used by IT teams and managed service providers. Researchers identified at least 21 affected production servers, including 19 running the latest security update. Key context: The immediate payload matters, but the attacker’s position matters more. Additional detail: For leaders, management infrastructure should be treated as having a wider potential impact than an ordinary server. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, N-central, servers, breached, hours, public, exploit, release.

Daily Cyber News: Cold-chain attacks turn refrigeration controls into business disruption Cold-chain operators face inventory loss and equipment hazards when attackers manipulate connected refrigeration controls. U.S. agencies issued a warning after attacks reportedly placed refrigeration systems serving up to 700 French supermarkets into defrost mode overnight. Stores had to discard spoiled goods, and estimated losses reached tens of millions of euros. Similar activity was reported in Belgium, Luxembourg and Sweden. Key context: The concern extends well beyond supermarkets. Additional detail: For leaders, refrigeration security should be treated as a business-continuity and safety concern, not simply an IT issue. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Cold-chain, attacks, refrigeration, controls, business, disruption.

Daily Cyber News: Telecom systems face active attacks on sensitive configurations Telecom and hosted communications environments face active attacks through Cisco BroadWorks. The weakness allows an unauthenticated remote attacker to send crafted XML and read sensitive configuration information. Cisco patched the issue in August, but CISA has now added it to its catalog of exploited vulnerabilities. Key context: BroadWorks supports cloud voice and collaboration services delivered by carriers and managed service providers. Additional detail: The broader pattern is continued targeting of shared service platforms that can expose multiple customers. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, cisco, Telecom, systems, face, active, attacks, sensitive.

Daily Cyber News: Outlook attacks raise urgency across a massive Microsoft update Authentication information is at risk through an Outlook weakness that attackers are already exploiting. A target must open a specially crafted message file. That action can make Outlook connect to an attacker-controlled network location without displaying its usual external-content warning. Key context: Microsoft’s November release addresses one thousand ninety five vulnerabilities, including 64 rated critical and 48 critical code-execution issues. Additional detail: For leaders, Office needs to be included in the emergency patch decision rather than hidden behind general Windows update reporting. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, windows, Outlook, attacks, raise, urgency, across, massive.

Daily Cyber News: AI attack agents accelerate web and cloud credential theft Production secrets and cloud data were exposed in attacks linked to self-hosted AntiFox systems. The open-source AI penetration-testing platform was operated from Alibaba Cloud infrastructure against internet-facing web services and AWS environments. Attackers deployed a webshell, examined application configuration, and used valid AWS identities for rapid discovery. Key context: The platform can automate repeated attack steps across web servers and cloud services with limited human effort. Additional detail: The durable pattern is faster chaining of web compromise, credential access, and cloud discovery. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, credential theft, attack, agents, accelerate, cloud, credential, theft.

Daily Cyber News: N-able upgrades hosted systems as exposed servers face scanning Managed service providers faced disruption after N-able took hosted N-central environments offline across the Americas, Europe, and Asia-Pacific. The company has now upgraded its hosted systems and released N-central 2026.4 HF2 for critical security issues. On-premises customers were strongly urged to upgrade before restoring normal access. Key context: N-central centrally manages networks and devices for enterprises and service providers, so a security failure could have broad reach. Additional detail: The broader lesson is that centralized management tools remain high-value targets because one console can affect many systems. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, N-able, upgrades, hosted, systems, exposed, servers, face.

Daily Cyber News: Poland takes public services offline after stopping cyberattack Citizens, businesses, and public institutions lost access to online government services after Poland temporarily shut down its ePUAP platform. Officials said security teams detected and stopped a cyberattack, then disabled the service as a precaution. The government said the infrastructure supporting key digital services remained secure. Key context: The disruption affects electronic document submissions, government communications, and other administrative procedures. Additional detail: Organizations running essential digital services should review their shutdown criteria, alternative service channels, and public communication plans. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Poland, takes, public, services, offline, stopping, cyberattack.

Daily Cyber News: N-able takes hosted management platform offline over disclosed risks N-able customers face management disruption after the company took its hosted N-central environment offline as a precaution. The action followed public disclosure of 33 critical security vulnerabilities while a hotfix was still being developed. N-able said it had not seen active exploitation at the time of its notice. Key context: Hosted customers cannot access the classic N-central environment, and associated services may be unavailable. Additional detail: Keep affected servers offline, use the alternate services that remain available, and wait for N-able’s remediation guidance before restoring access. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, active exploitation, N-able, takes, hosted, management, platform, offline.